CVE-2026-40293

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40293", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T20:22:44.035Z", "datePublished": "2026-04-17T20:47:06.804Z", "dateUpdated": "2026-09-09T12:04:43.487Z"}, "containers": {"cna": {"title": "OpenFGA Playground Preshared Key Exposure", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5"}, {"name": "https://github.com/openfga/openfga/releases/tag/v1.14.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/openfga/openfga/releases/tag/v1.14.0"}], "affected": [{"vendor": "openfga", "product": "openfga", "versions": [{"version": ">= 0.1.4, < 1.14.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T20:47:06.804Z"}, "descriptions": [{"lang": "en", "value": "OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It is intended for local development and debugging and is not designed to be exposed to production environments. Only those who run OpenFGA with `--authn-method` preshared, with the playground enabled, and with the playground endpoint accessible beyond localhost or trusted networks are vulnerable. To remediate the issue, users should upgrade to OpenFGA v1.14.0, or disable the playground by running `./openfga run --playground-enabled=false.`"}], "source": {"advisory": "GHSA-68m9-983m-f3v5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T16:19:32.851531Z", "id": "CVE-2026-40293", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:19:40.914Z"}}, {"affected": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.7::el9"], "defaultStatus": "affected", "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product": "Multicluster Global Hub 1.7.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779925273", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.14::el9"], "defaultStatus": "affected", "packageName": "rhacm2/acm-grafana-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782693386", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.15::el9"], "defaultStatus": "affected", "packageName": "rhacm2/acm-grafana-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780677003", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:6"], "defaultStatus": "unknown", "packageName": "rhceph/rhceph-6-dashboard-rhel9", "product": "Red Hat Ceph Storage 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:9"], "defaultStatus": "unknown", "packageName": "rhceph/grafana-rhel10", "product": "Red Hat Ceph Storage 9", "vendor": "Red Hat"}], "datePublic": "2026-04-17T20:47:06.804Z", "descriptions": [{"lang": "en", "value": "A flaw was found in OpenFGA, an authorization/permission engine. When OpenFGA is configured to use preshared-key authentication and the built-in playground is enabled and accessible beyond localhost or trusted networks, a remote attacker can exploit this vulnerability. The local server includes the preshared API key in the HTML response of the /playground endpoint, leading to information disclosure of the API key. This can allow unauthorized access to the system."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-40293"}, {"name": "RHBZ#2459341", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459341"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40293.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:24503"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:36882"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:24539"}], "solutions": [{"lang": "en", "value": "RHSA-2026:24503: Multicluster Global Hub 1.7.0"}, {"lang": "en", "value": "RHSA-2026:36882: Red Hat Advanced Cluster Management for Kubernetes 2.14"}, {"lang": "en", "value": "RHSA-2026:24539: Red Hat Advanced Cluster Management for Kubernetes 2.15"}], "timeline": [{"lang": "en", "time": "2026-04-17T22:01:37.276Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-17T20:47:06.804Z", "value": "Made public."}], "title": "OpenFGA: github.com/openfga/openfga: OpenFGA: Information disclosure of preshared API key via playground endpoint", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-09T12:04:43.487Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "OpenFGA: github.com/openfga/openfga: OpenFGA: Information disclosure of preshared API key via playground endpoint", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:multicluster_globalhub:1.7::el9"], "vendor": "Red Hat", "product": "Multicluster Global Hub 1.7.0", "versions": [{"status": "unaffected", "version": "1779925273", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.14::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "versions": [{"status": "unaffected", "version": "1782693386", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-grafana-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.15::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "versions": [{"status": "unaffected", "version": "1780677003", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-grafana-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:6"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 6", "packageName": "rhceph/rhceph-6-dashboard-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:ceph_storage:9"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 9", "packageName": "rhceph/grafana-rhel10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2026-04-17T22:01:37.276Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-17T20:47:06.804Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:24503: Multicluster Global Hub 1.7.0"}, {"lang": "en", "value": "RHSA-2026:36882: Red Hat Advanced Cluster Management for Kubernetes 2.14"}, {"lang": "en", "value": "RHSA-2026:24539: Red Hat Advanced Cluster Management for Kubernetes 2.15"}], "x_adpType": "supplier", "datePublic": "2026-04-17T20:47:06.804Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-40293", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459341", "name": "RHBZ#2459341", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40293.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:24503", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:36882", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:24539", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in OpenFGA, an authorization/permission engine. When OpenFGA is configured to use preshared-key authentication and the built-in playground is enabled and accessible beyond localhost or trusted networks, a remote attacker can exploit this vulnerability. The local server includes the preshared API key in the HTML response of the /playground endpoint, leading to information disclosure of the API key. This can allow unauthorized access to the system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-07T12:04:58.050Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40293", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:19:32.851531Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:19:37.062Z"}}], "cna": {"title": "OpenFGA Playground Preshared Key Exposure", "source": {"advisory": "GHSA-68m9-983m-f3v5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "openfga", "product": "openfga", "versions": [{"status": "affected", "version": ">= 0.1.4, < 1.14.0"}]}], "references": [{"url": "https://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5", "name": "https://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openfga/openfga/releases/tag/v1.14.0", "name": "https://github.com/openfga/openfga/releases/tag/v1.14.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It is intended for local development and debugging and is not designed to be exposed to production environments. Only those who run OpenFGA with `--authn-method` preshared, with the playground enabled, and with the playground endpoint accessible beyond localhost or trusted networks are vulnerable. To remediate the issue, users should upgrade to OpenFGA v1.14.0, or disable the playground by running `./openfga run --playground-enabled=false.`"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T20:47:06.804Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40293", "state": "PUBLISHED", "dateUpdated": "2026-09-07T12:04:58.050Z", "dateReserved": "2026-04-10T20:22:44.035Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T20:47:06.804Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openfga", "vendor": "openfga", "versions": [{"status": "affected", "version": ">= 0.1.4, < 1.14.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.7::el9"], "defaultStatus": "affected", "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product": "Multicluster Global Hub 1.7.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779925273", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.14::el9"], "defaultStatus": "affected", "packageName": "rhacm2/acm-grafana-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782693386", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.15::el9"], "defaultStatus": "affected", "packageName": "rhacm2/acm-grafana-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780677003", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:6"], "defaultStatus": "unknown", "packageName": "rhceph/rhceph-6-dashboard-rhel9", "product": "Red Hat Ceph Storage 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:9"], "defaultStatus": "unknown", "packageName": "rhceph/grafana-rhel10", "product": "Red Hat Ceph Storage 9", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*", "matchCriteriaId": "16E139C5-9250-4B93-9B6A-4223AE8FC977", "versionEndExcluding": "1.14.0", "versionStartIncluding": "0.1.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It is intended for local development and debugging and is not designed to be exposed to production environments. Only those who run OpenFGA with `--authn-method` preshared, with the playground enabled, and with the playground endpoint accessible beyond localhost or trusted networks are vulnerable. To remediate the issue, users should upgrade to OpenFGA v1.14.0, or disable the playground by running `./openfga run --playground-enabled=false.`"}], "id": "CVE-2026-40293", "lastModified": "2026-08-24T13:18:31.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40293", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T16:19:32.851531Z", "version": "2.0.3"}}]}, "published": "2026-04-17T21:16:34.567", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/openfga/openfga/releases/tag/v1.14.0"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:24503"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:24539"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:36882"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-40293"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459341"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40293.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-201"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "OpenFGA: github.com/openfga/openfga: OpenFGA: Information disclosure of preshared API key via playground endpoint", "id": "2459341", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459341"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A flaw was found in OpenFGA, an authorization/permission engine. When OpenFGA is configured to use preshared-key authentication and the built-in playground is enabled and accessible beyond localhost or trusted networks, a remote attacker can exploit this vulnerability. The local server includes the preshared API key in the HTML response of the /playground endpoint, leading to information disclosure of the API key. This can allow unauthorized access to the system."], "name": "CVE-2026-40293", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Affected", "package_name": "rhceph/rhceph-6-dashboard-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Affected", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}], "public_date": "2026-04-17T20:47:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-40293\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40293\nhttps://github.com/openfga/openfga/releases/tag/v1.14.0\nhttps://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5"], "statement": "This is an Important information disclosure flaw in OpenFGA, an authorization engine used in Red Hat products. The vulnerability occurs when OpenFGA is configured with preshared-key authentication and its built-in playground is enabled and exposed beyond localhost or trusted networks. The /playground endpoint, intended for development, can then reveal the preshared API key, potentially leading to unauthorized access.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.1.4,1.14.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openfga", "source": "cna", "vendor": "openfga"}, "product": "openfga", "vendor": "openfga"}], "analysis": {"en": {"generated_at": "2026-04-22T06:00:54.907335+00:00", "value": {"mitigation_remediation": ["Upgrade OpenFGA to version 1.14.0 or later to eliminate the key exposure.", "If an upgrade is not yet possible, disable the playground feature by running ./openfga run --playground-enabled=false.", "In production deployments, avoid using preshared\u2011key authentication and ensure the playground is either disabled or restricted to trusted local networks."], "summary": {"action": "Immediate Patch", "impact": "Exposes preshared API key in playground response"}, "threat_synthesis": {"affected_systems": "Products affected are OpenFGA, version range 0.1.4 through 1.13.1. The issue exists only when the server is started with the --authn-method preshared flag and the playground is enabled (the default). Systems that restrict the /playground endpoint to localhost or otherwise protected networks are not vulnerable. All other OpenFGA versions are unaffected.", "description_and_impact": "The vulnerability in OpenFGA occurs when the playground feature is enabled and the server is configured to use preshared\u2011key authentication. In this configuration, requests to the /playground endpoint return the API key as part of the HTML payload. This disclosure of a secret credential can lead to credential compromise, allowing an attacker who can reach the host to authenticate to the service with elevated privileges. The weakness is an information\u2011disclosure flaw, categorized as CWE\u2011200, and an authentication bypass flaw, categorized as CWE\u2011201.", "risk_and_exploitability": "The issue has a CVSS score of 6.5, indicating moderate severity. The EPSS score of 0.00056 indicates a very low probability of exploitation and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a network attacker who can reach the OpenFGA host and send an HTTP request to /playground. Because the endpoint requires no authentication, the attacker can obtain the preshared key directly. Once the key is known, it can be used to authenticate to the server, potentially giving the attacker full control over the authorization engine. The condition of the playground being accessible beyond localhost or from untrusted networks is a prerequisite, so securing the endpoint or disabling the playground mitigates the risk."}}}}, "created": "2026-04-17T22:30:29.501507+00:00", "updated": "2026-04-22T06:15:10.421635+00:00", "vendors": ["openfga", "openfga$PRODUCT$openfga"]}